android调用C语言实现内存的读取与修改

写之前需要准备以下内容

Android studio
已ROOT安卓设备
GG修改器

打开android studio,创建Native c++ Project

MainActivity.java

package com.gs.jc;
import androidx.appcompat.app.AppCompatActivity;
import android.os.Bundle;
import android.view.View;
import android.widget.TextView;
public class MainActivity extends AppCompatActivity {
    private TextView textView;
    private JNI jni;
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        jni = new JNI();
        textView = (TextView) findViewById(R.id.tv);
    }
    public void btn(View view) {
        textView.setText(String.valueOf(jni.searchMem()));
    }
}

新建一个java类,以实现java调用对应C代码

package com.gs.jc;
public class JNI {
    static {
        System.loadLibrary("native-lib");
    }
	
    public native int searchMem();
}

O_RDONLY 只读打开
O_WRONLY 只写打开
O_RDWR 可读可写打开
O_SYNC 以同步的方式打开文件

C++核心代码

#include 
#include 
#include 
#include 
#include 
#include 
#include 
static int fd = 0;
//查找游戏进程pid
int getPID(const char *pack_name) {
    int id = -1, pid = -1;
    DIR *dir = 0;
    FILE *file = 0;
    char filename[32] = {0};
    char cmdline[256] = {0};
    struct dirent *entry = 0;
    if (pack_name == NULL) {
        return -1;
    }
    dir = opendir("/proc");
    if (dir == NULL) {
        return -1;
    }
    while ((entry = readdir(dir)) != NULL) {
        id = atoi(entry->d_name);
        if (id > 0) {
            sprintf(filename, "/proc/%d/cmdline", id);
            file = fopen(filename, "r");
            if (file) {
                fgets(cmdline, sizeof(cmdline), file);
                fclose(file);
                if (strcmp(pack_name, cmdline) == 0) {
                    pid = id;
                    break;
                }
            }
        }
    }
    closedir(dir);
    return pid;
}
//打开文件句柄
int open_proc_mem(int pid) {
    if (pid <= 0)
        return -1;
    char mempath[64] = {0};
    int handle = -1;
    sprintf(mempath, "/proc/%d/mem", pid);
    handle = open(mempath, O_RDWR, O_SYNC);
    return handle;
}
//读内存
void pread64_mem(int fd, void *buff, int size, long *addr) {
    if (fd <= 0 || buff == NULL || size <= 0 || addr == NULL)
        return;
    pread64(fd, buff, size, (unsigned long) addr);
}
//写内存
void pwrite64_mem(int fd, const void *buff, int size, long *addr) {
    if (fd <= 0 || buff == NULL || size <= 0 || addr == NULL)
        return;
    pwrite64(fd, buff, size, (unsigned long) addr);
}
extern "C"
jint Java_com_gs_jc_JNI_searchMem(JNIEnv *env, jobject thiz) {
    char *game = "com.tencent.tmgp.sgame";  //包名
    int pid = getPID(game);		//获取进程PID
    fd = open_proc_mem(pid);	//打开进程内存
    //long base = 0;
    long buf[1] = {666};				//需要修改内存的值
    long *addr = (long *) 0x12C0085C;	//内存地址:0x12C0085C
    pwrite64_mem(fd, &buf[0], 4, addr);	//写入内存数据
    //pread64_mem(fd, &base, 4, addr);
    return pid;
}

C代码中需要自行修改的地方
char *game = “com.tencent.tmgp.sgame”; //包名
long *addr = (long *) 0x12C0085C;//内存地址

效果图链接:
https://www.lanzous.com/b0dppncji

以上是简单的内存地址修改方法，右上角关注后续讲解模糊搜索、联合搜索、特征码定位